Claude Code Symlink Flaw Could Exfiltrate Files via `CLAUDE.md` Imports

Tego AI disclosed a flaw in Anthropic’s Claude Code that can cause the tool to read files outside a cloned repository and include their contents in the first outbound model request without the warning or approval prompt users would normally expect. The issue abuses a committed CLAUDE.md file containing an @import directive that points to a symbolic link inside the repository; Claude Code validates the in-repo path, but the filesystem resolves the link to an external file such as /etc/passwd, enabling silent data exposure. Tego AI said the behavior was confirmed in Claude Code v2.1.x.

The researchers said the bug reflects the same underlying symlink-check weakness previously addressed in Claude Code under CVE-2025-59829 and CVE-2026-25724, but still reachable through the startup memory loader code path. Anthropic reportedly closed the July 2026 HackerOne report as Informative, maintaining that the product’s “trust this folder” prompt defines the intended security boundary and already grants broad project access. Tego AI disputed that position, warning that predictable sensitive file paths in CI runners, containers, and standardized developer images could make the flaw relevant for enterprise AI coding-agent deployments.